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Abstract 

We study the class of languages, denoted by MIPl[fc, 1 — e, s], which have k- 
prover games where each prover just sends a single bit, with completeness 1 — e and 
soundness error s. For the case that k = 1 (i.e., for the case of interactive proofs), 
Goldreich, Vadhan and Wigderson {Computational Complexity '02) demonstrate 
that SZK exactly characterizes languages having 1-bit proof systems with "non- 
trivial" soundness (i.e., 1/2 < s < 1 — 2e). We demonstrate that for the case that 
k > 2, 1-bit fc-prover games exhibit a significantly richer structure: 

• (Folklore) When s < ^ - e, MIPl[fc, 1 - e, s] = BPP; 

• When ^+e<s<^-e, MIPl[fc, 1 - e, s] = SZK; 

• When s > ^ + e, AM C MIPl[fc, 1 - e, s]; 

• For s < 0.62fc/2'= and sufficiently large k, MIPl[fc, 1 - e, s] C EXP; 

• For s > 2k/2'', MIPl[fc, 1, 1 - e, s] = NEXP. 

As such, 1-bit fc-prover games yield a natural "quantitative" approach to relating 
complexity classes such as BPP, SZK, AM, EXP, and NEXP. We leave open the 
question of whether a more fine-grained hierarchy (between AM and NEXP) can 
be established for the case when s > ^ + e. 

1 Introduction 

We study the expressiveness of fc-prover games (introduced by Ben-Or, Goldwasser, Kil- 
ian and Wigderson |BOGKW88| ). where each prover sends a single bit. Let MIP1[A:, 1 — 
e,s] denote the class of languages having a fc-prover game where each prover sends a 
single bit, completeness 1 — e, and soundness error s. Throughout the paper, we think 
of fc as a constant and e as an arbitrarily small constant. Clearly, for a fixed k, as s 
increases the corresponding complexity class can only become larger. We are interested 
in understanding to what extent the complexity class grows, and whether the growth is 
"smooth" or if threshold phenomena occur. 

When the soundness error is "too small" , only trivial languages can have such games. 
In particular, provers sending random bits succeed with probability at least (1 — e)2~''', 
placing the language of any protocol with smaller soundness in BPP. 
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Theorem 1.1 (Folklore, implicit in |BGS98] ). For every k > I, e > 0, we have 

MIPl[fc,l-e, l/2''-e] = BPP 

An interesting result by Goldreich, Vadhan and Wigderson jGVW02] shows that 
when k ~ 1 (i.e., for interactive proofs (GMR89I IBM88| ). whenever the soundness is 
"non-trivial", then MIP1[1,1 — e, s] characterizes SZK, the class of languages having 
statistical zero-knowledge proofs. We here focus on the case when k > 2. As we shall 
see, in this setting, 1-bit fc-prover games contains a richer variety of complexity classes. 
We take a first step towards characterizing these classes. 

Our first result is a simple generalization of the result of [G V W02j : we show that 
when ^ + e<s<^ — e, then MIPl[fc, 1 — e, s] characterizes SZK. 

Theorem 1.2. For every k > 2, e > 0, and 1/2*^ -|- e < s < 2/2*^ — e, we have 

MIPl[A:,l-e,s] = SZK. 

Our main result next shows that when the soundness becomes just slightly higher 
than 2/2*"', MIPls appear to become significantly more powerful; in particular, they 
contain all of AM. 

Theorem 1.3 (Main Theorem). For every k > 2 and e > 

AM C MIPl[A:,l-e,2/2'^ + e] 

For instance, when k — 2, our MIPl has soundness error + e. This result should be 
compared to Hastad's 3-bit PCP |Has01) that achieves the same soundness error. Since 
every 1-bit A:-prover game yields a fc-bit PCP, our MIPl yields a 2-bit PCP for AM with 
soundness error 1/2 -I- e; in contrast, the PCP resulting from our MIPl is exponentially 
long, whereas Hastad's PCP is polynomially long. Nonetheless, as we shall see shortly, 
our MIPl construction heavily relies on Hastad's PCP. 

We leave open the question of whether MIPl[fc, 1 — e, 2/2*^ -|- e] contains even richer 
complexity classes than AM. As a first step towards this question, we note that EXP is 
an upper bound on this class. 

Theorem 1.4. For all sufficiently large k, e > 0, s < ^'^^ ^ (1 — e) we have 

MIPl[fc, l-e,s] C EXP. 
This holds also for fc = 3 and s < 1/2 — e. 

Finally, we prove that for fc > 3 and sufficiently high soundness error, fc-prover 1- 
bit MIPls capture all of NEXP. This follows by using the PCP analogue of the classic 
MIP ~ NEXP result [BFL91| . We sharpen the parameters by using more modern PCP 
machinery and then observing that the PCPs we use can be turned in to MIPl at no 
cost. In particular using the recent results by Chan |Chal2j . we get 

Theorem 1.5. For every e > and s = 2^°^ ('=+1)1 /2'' + e < 2fc/2'= -I- e, 

MIPl[fc, l-e,s] = NEXP. 

Taken together, these results demonstrate that fc-prover games provide a natural 
"quantitative" way to relate complexity classes such as BPP, SZK, AM, EXP and NEXP. 
We leave open the question of whether MIPl[fc, 1 — e, s] contains an even more fine 
grained hierarchy of complexity classes in the regime where s > 2/2^= + e. 
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1.1 Related work 



The work most closely related to our is the work by Goldreich, Vadhan and Wigderson 
[GVW02] mentioned above which in turn builds on a work by Goldreich and Hastad 
[GH98| : just as we do, both these works investigate the complexity of interactive proofs 
with "laconic" provers. We have taken the question to an extreme in one direction 
(namely we focus only on provers that send a single bit); on the other hand, we have 
generalized the question by considering multi-prover interactive proofs, rather than just 
a single prover (as is the main focus in the above-mentioned works). 

The large literature on PCP characterizations of NP (e.g., [XS98l I ALM+QSl IBGLR91 
IBGS98 , GLST98, STOO and many others) is clearly also very related. As mentioned, a 
fc-prover Ml PI yields a fc-query PCP with the same soundness error, but of exponential 
length; typically, the PCP literature focuses on polynomial-length proofs. Nonetheless, 
we rely on both PCPs and techniques from this literature (most notably Fourier analysis) 
to analyze our proof system. 

We also mention the recent work by Drucker |Drull| that provides a PCP-type 
characterization of AM; his result is incomparable to our main theorem as he focuses on 
polynomial-length PCP proofs. 

1.2 Outline 

In Section [2] we present some definitions and background material that we use. In 
Section [3] we prove Theorem 11.21 for the SZK range. Our main result Theorem 11.31 is 
proved in Section U) The Theorems 11.41 and II .51 are proved in Section [5] Finally, we end 
with discussing some avenues for future work in Section [B] 

2 Preliminaries 

2.1 Laconic Proof systems 

We assume familiarity with multi-prover interactive proofs and probabilistically check- 
able proofs. 

Definition 2.1. IP[A;, c, s] denotes the class of problems having an two message protocol 
where the first message is sent by the Verifier and where the prover sends at most k bits 
and where the proof has soundness s and completeness c. 

Definition 2.2. MIPl[fc, c, s] denotes the set of languages having a Multi-prover Inter- 
active Proof System with k provers, each sending a single bit, soundness s, completeness 
c. The questions to the k provers are asked simultaneously. In other words, all questions 
are formulated before any answer is recieved. 

Fact 2.3. For every fc > 1, < s < c < 1, we have 

IP[fc,c, s] C MIPl[fc, c,s]. 

When constructing Ml PI it is convenient to rely on efficient PCPs. There are general 
translations from PCPs to MIPls (one is given in |BGS98) 1 if one accepts a slight loss in 
the parameters. In the cases we are interested in, however, by a slight extension of the 
analysis we can turn the PCP directly into a MIPl without any loss in parameters. 

2.2 Statistical Zero Knowledge 

For our characterization of the SZK range, we only need to rely on the following result 
of |GVW02j relating SZK to laconic IP systems. 
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Theorem 2.4 f |GVW02j . Theorem 3.1). For every c, s such that 1 > > s > c/2 > 0, 
it holds that IP[1, c,s] = SZK. 

2.3 Fourier Analysis of Boolean Functions 

For two vectors x,y Cz {0, 1}" we write x (B y for their pointwise sum modulo 2. Given 
a e {0, 1}" we write Xa ■ {0, 1}" — ?> M for the character (which is in fact a hnear 
function) Xa{x) — (— 1)^?=! . 

Any Boolean function / : {0, 1}" — > K can be uniquely decomposed as a linear 
combination of characters 

fi^) = ha)Xa{x), 

ae{0,l}" 

where /(a) = 'Kx[f {x)xa{x)\ are the Fourier coefficients of /. 

We recall Plancherel's equality: for any / : {0, 1}" M, we have 

a 

2.4 Inapproximability of Linear Equations 

Our proof system for AM is based on the optimal inapproximability result for linear 
equations mod 2 by Hastad [HasOlj . defined next. 

Definition 2.5. An instance ^ of Max 3-Lin-2 consists of a set of equations in n 
variables xi, . . . ,a;„ over {0, 1}. Each equation is of the form xi{^) = ^ for some I S 
{0, 1}" of weight 3 and some h £ { — 1, !}• We denote by Opt(\l/) G [0, 1] the maximum 
fraction of equations satisfied by any assignment to x. 

Theorem 2.6 f |Has01) ). For every e > 0, given a Max 3-Lin-2 instance ^P, it is 
NP-hard to determine whether Opt(^) < 1 ^ e or whether Opt(5') > ij^. 

3 The SZK range 

Theorem 3.1. For every k > 1, e > 0, we have 

IP[fc,l- e,l/2'^ + e] D SZK. 

Proof. Follows by repetition of the protocol from Theorem 12.41 and the fact that there 
is no problem with parallel repetition for one-prover proof systems. □ 

Proposition 3.2. For every k>l,0<s<c<l, we have 

MIPl[fc,c, s] C IP[l,c,2'^-\s]. 

Proof. Given a MIPl protocol {V,Pi, . . . ,Pk) for a language L, we construct a single- 
prover protocol {V',P') as follows. The verifier V' runs V to generate k messages 
xi, . . . ,Xk, and sends xi to the prover P' . The prover P' acts as Pi and responds with an 
answer yi G {0,1}. V accepts iff there are bits y2, • ■ • , 2/fc such that the original verifier V 
accepts on the transcript {xi,. . . , Xk,yi, . ■ . , yk)- Clearly, the completeness of {V , P') is 
at least that of the original protocol. For the soundness, suppose that there is a strategy 
for P' that makes the verifier accept with probability s' . Construct a strategy for the 
original protocol by having Pi act as P' and P2, . . . , Pk return random answers. Clearly, 
these provers make V accept with probability at least s'/2'^~^, implying s' < 2''~^s as 
desired. □ 
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Theorem 3.3. For every k>\, and every e > it holds that 

MIPl[fc,l - e,2/2'^'(l - 2e)] C SZK 

Proof. We have 

MIPl[fc, 1-e, 2/2*^(1 -2e)] C IP[1, 1, 1 - e, 1 - 2e] (Proposition [S2]) 

C SZK (Theorem [231) 

□ 

4 Proof systems for AM 

First we note that, at a cost of an arbitrarily small loss in soundness and completeness, 
we may restrict ourselves to proof systems for NR. 

Lemma 4.1. If NP C MIPl[fc, c, s] then for every e > it holds that AM C MIPl[fc,c- 

e,s + e] 

Proof. Let i e AM. We remind the reader that this is equivalent to the existence of 
a language i' S NP such that x G L iS {x, r) g L' with high probability for a random 
string r (of an appropriate polynomial length). Without loss of generality, we may 
assume that the protocol for L has completeness 1 — e and soundness e. The Ml PI 
verifier for L simply sends Arthur's random string r to each of the k provers and then 
executes the MlPl protocol assumed to exist for L' g NP. 

If X G L then with probability 1 — e over r we have (x, r) £ L' in which case the 
provers convince the verifier with probability > c. 

On the other hand x ^ L then the probability that the provers accept is at most 
Pr^ [{x, r) e L'] + Vy[{x, r) ^ L'] Pr[accept \{x,r) ^ L'] < e + s. □ 

4.1 Warm-up: the case of 2 provers 

We start off with the case of only 2 provers, as this case is somewhat simpler than the 
general case, and will be used to obtain the general case. 

Theorem 4.2. For every e > 

NP C MIP1[2,1 -e,l/2 + e]. 

Proof. We reduce from the Max 3-Lin-2 problem. Given is a Max 3-Lin-2 instance 
on n variables xi, . . . ,x„ and m linear equations {li{xi) = ^i}ig[m]- 
The provers are expected to provide oracle access to the Hadamard encoding of a 
(1 — e)-satisfying assignment x G {0, 1}". hi other words, the verifier will give each 
prover a vector a G {0, 1}" and expects in response the value of the linear function 

Xa(x)G{-l,l}. 

The verifier proceeds as follows: 

1. Pick a random equation xi{^) = & in ^ 

2. Pick random y E {0, 1}" 

3. Check that ^2(2/) ■ Pi{l®y)^b 
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It is easy to see that there is a strategy for the provers which makes the verifier 
accept with probabiUty at least Opt(5'). More interestingly, we will now prove that, 
Opt(5') is exactly the maximum acceptance probability, over any strategy for Pi and 
P2. 

We can then write the acceptance probability of the verifier as 



l + bPiil®y)P2iy) 



PrfVerifier accepts! ~ E 

ye{o,ir 
(/,6)e* 

Replacing the two functions by their Fourier expansion we need to analyze 



(1) 



5]A(a)A(a') E [bxail®y)Xa'{y)]. 

a, a' 

All terms with a ^ a! have expectation and furthermore we have 

E {hXail)\ <2 0pt(*)-l, 

{l,V) 

as the assignment given by a satisfies at most an Opt(5') fraction of the equations and at 
least a fraction 1 — Opt(^) as its negation does not satisfy more than a Opt(^) fraction. 
We conclude that ^ is bounded by 

l + EalA(a)A(a)|(2 0ptW-l) 



2 

Finally note that, by Cauchy-Schwarz, 



a \ a / \ a / 



and this finishes the argument. □ 

4.2 The general case 

We have 

Theorem 4.3. For every k > 2, e > 0, we have 

NPC MIPl[fc,l-e,2/2'= + e]. 

Proof. As before, we design a MIPl system for linear equations. Given is a Max 3-Lin-2 
instance in which either Opt(\[') > 1 — eo, or Opt(\I') < where eo wiU be chosen 

small enough to get the completeness and soundness bound that we want. 

The verifier again expects all the k provers to provide answers to the Hadamard 
coding of the good assignment, and it then does the obvious generalization of the k = 2 
case: 

1. Pick fc — 1 random equations lj{x) =bj,l<j<k~l 

2. Pick random y E {0, 1}" 

3. Check that Pj{lj © y) ■ Pk{y) hj for every 1 < j < fc — 1 
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It is clear that the completeness is at least (1 — cq)'^"^ > 1 — fceo- Thus, as long as 
eo 5: ^/k, we have the desired completeness. 

Let us now study the soundness, i.e., the maximum possible acceptance probability 
of verifier, given that Opt(^') < 

We say that prover Pj succeeds if Pj {Ij ® y) ■ Pk (y) = bj . From the analysis of the 
previous theorem, we know that the probability that Pj succeeds is at most -i-^. Thus, 
if the events that the different provers succeed were independent, we would obtain the 
desired soundness of « 2^"*^. However, a priori, it may be that the success events of the 
provers are very correlated, e.g., it could be that if one succeeds then they all succeed. 

To cope with this, we need to obtain a more robust version of the previous analysis. 
Let "'""'"'^j'-^^ be the probability that Pj succeeds given that y is chosen. We have the 
following lemma. 

Lemma 4.4. ¥.y[5j{y)] < eg. 

Proof. We have 6j{y) = E(,^b)[fePfe(y)Pj(? ® y)] and thus 

E[5|(y)] = E ^ ^ [bb'P,{l ® y)P,{l' ® y)]. 

V (,Lb),{l',b'),y 

Similarly to the case fc = 2 we replace the function by its Fourier expansion and we are 
left to analyze 

^F,(a)P,-(a') E JbyXa{l + y)Xa'{l'+y)]. 

— ' y,(Lb),(l',b') 
a, a' 

Again we only have nonzero terms when a — a' . For these terms it easy to see that 

< (2 0pt(vI/)-l)2^e2^ 

Using Pji^)^ ~ the lemma follows. □ 

Lemma 14.41 implies that the fraction of y such that 5j{y) > is bounded by eq. 
We conclude that the, for the y chosen, the probability that 6j{y) > ^/eQ for any j is 
bounded by fceo. On the other hand if 6j{y) < for all values of j the probability that 

the verifier accepts is bounded by ( ^~^^^ )''^^ ■ We conclude that the overall probability 
that the verifier accepts is bounded by 

and choosing eo sufficiently small, this is bounded by 2^^*^ + e. □ 

5 The High End - EXP and NEXP Results 

In this section we prove Theorems 11.41 and 11.51 These are essentially just "blow-ups" of 
corresponding approximation algorithms and inapproximability results. 

Theorem 5.1 fTheorem ll.4l restated). For all sufficiently large k, e > 0, s < ^^^|^(1 — e) 
we have 

MIPl[fc,l-e,s] C EXP. 
This holds also for fc = 3 and s < 1/2 — e. 



E \bb'Xa{l)Xa{n] 
\l',b') 



7 



Proof. Let L e MIPl[fc, 1 - e, s] with s < - e). Given an instance, the task of 

determining whether x € L boils down to finding the best joint strategy for the k provers. 
If the verifier uses r random bits she can send at most 2*" different queries to each prover, 
thus the optimal strategy can be described by fc • 2'' = 2p°'^I^I bits. Further, for each 
outcome of the verifier's randomness, the acceptance criterion is a constraint on some k 
bits of the strategy. In other words, what we have is an exponentially large Max fc-CSP 
instance. The value of this instance can be approximated in time polynomial in its size to 
within a factor 0.62fc/2'^ by the algorithm of Makarychev and Makarychev |MM12J. For 
the case fc = 3 we use the 1/2-approximate Max 3-CSP algorithm of Zwick [Zwi98 . □ 

Next we show that if the soundness is sufficiently large, exponential-size fc-query PCP 
systems can express every language in NEXP. 

Theorem 5.2. For t — 2r'°S2('=+i)l (k + 1 rounded up to the next power of 2) we have 

MIPl[fc,l - e,tl2^ + e] = NEXP. 
This immediately implies Theorem 11.51 

Proof sketch. The proof follows from a upscaling of the recent PCP of Chan |Chal2| 
that gives a predicate of arity k which has t accepting configurations and which is 
approximation resistant. 

In a standard PCP, the verifier runs in polynomial time, uses a logarithmic number 
of random coins and reads a constant number of bits in a polynomial size proof and 
verifies an NP-statement. We are currently interested in the situation where the crucial 
parameters, except the running time of the verifier, are exponentially larger. 

To be more precise we are interested in a polynomial time verifier, that uses a 
polynomial number of random coins and gets one bit each from k different provers that 
respond to questions of polynomial length. 

As is convenient for us, Chan already analyzed his PCP in the fc-partite situation 
where each bit is read from a separate table. This model is exactly the same as a 
fc-prover model and hence this difference is only syntactical. 

It remains to address the question on how to make the upscaled verifier run in 
polynomial time. This amounts to saying that a verifier of an NEXP statement runs 
in polynomial time. This was explicitly needed in |BFL91| but this paper predates the 
PCP-Theorem. The fact that this is true also for upscaled versions of the PCP-Theorem 
has been explicitly stated in |BGS98) and [BSGH+OS] . The intuitive reason that this is 
true is that the verifier only needs to ensure that some bits in a suitable encoding of the 
inputs are correct and this takes polynomial time in the size of the input but not the 
other parameters of the proof. □ 

6 Concluding Remarks 

There are a number of interesting avenues for further work. In this paper we focused 
solely on the case of almost perfect completeness and each prover sending exactly 1 bit. 
Obviously, understanding what happens with the expressiveness of these systems for 
other completeness values (in particular perfect completeness) and slightly less laconic 
provers would be very interesting. By simple extensions of the methods used in this 
paper it is possible to get some results but it would be interesting to see if perfect 
completeness could lead to a significantly different situation in any range of parameters. 

There is also a specific question more directly related to the current paper. There is a 
huge gap between our lower bound AM and upper bound EXP for soundness s = 2/2*^ + 6. 
It seems quite plausible that an upper bound for this range of s should be PS PACE rather 
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than EXP - proving this essentially boils down to proving that there is a (5 > such that 
bipartite instances of Max 2-CSP can be approximated within a factor l/2+(5 in polylog- 
space (and not necessarily polynomial time). We hope that the recent algorithms for 
Max Cut, in particular |KS11| . can be adapted to achieve this. 

Even if this turns out to be true, whether the correct class here is AM or PSPACE 
or something in between we have little intuition about. 

Acknowledgment. We are grateful to Salil Vadhan for pointing out a simple proof 
of the lower bound given in Theorem 11.21 rather than the more complicated proof with 
worse parameters that we originally had. We are also grateful to Madhu Sudan and Or 
Meir for discussions on how to blow-up PCPs. 
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